Lets take a look at how we can achieve this on a Lenovo T61 laptop. The following steps worked for me.

• Power on the system and during the boot up, holding onto F1 key will let you into BIOS.
• Once you are in the BIOS, browse to Config->Intel AMT
• Change the Intel AMT settings to "disabled", save the settings and exit
• After the BIOS settings are saved, the system will automatically reboot
• On the power up, you will see a message about finishing the unconfiguration of AMT, do you want to continue (Yes/NO) -- Select Yes
• This will unconfigure all of AMT/ME settings and all the passwords are reset
• You will need to enter BIOS again, browse to Config->Intel AMT, change Intel AMT setting to "Enabled"
• After the BIOS settings are saved, next time when the system is powering up, you will need to hit "ctrl-P" to configure ME/AMT again.
• This time you will be using the default ME password ("admin")
• You know the drill from here :-)

If there are any further questions, feel free to post your questions on the manageability forum.

Many of the ISVs are now developing their applications based on WS-Management protocol. You may ask, there are so many of Intel AMT enabled machines that are below AMT 3.0 out it the market, how will these new management applications manage them? All of the vPro machines with firmware version below AMT 3.0 can only communicate using the legacy SOAP based protocol.

To address the gap between the management of pre-AMT 3.0 machines using the new ISV management applications based on WS-Management, Intel has come up with the WS-Management translator tool. For instructions on how to use the translator tool, refer to the readme file in the installation package.  Using Intel WS-Management translator tool, management consoles can issue WS-Man commands to the translator, the translator will perform the equivalent operation using the legacy SOAP interface.

Along with the installable package, source code is also made available for the ISVs. The source code will allow for tighter integration of the ISV management application with the translator. What does that do for me? With the management application that was developed based on WS-Management protocol,  and integrating Intel WS-Management Translator, now you have the ability to manage all generation of Intel AMT systems seamlessly. Check out this primer describing Intel AMT and WS-Management.

In summary, if you are an ISV developing the management application using WS-Man, and want to manage all generation of Intel AMT devices, Intel WS-Management translator is a very useful tool for you. For any questions on this tool or other Intel AMT related questions, submit your questions in the manageability community.

Inside the operating system (OS), when you want to connect over wireless interface, you will search for SSID or create a profile with the SSID name, configure it with the authentication details and any other credentials required. Using these wireless settings (also known as wireless profile), the OS will start connecting over the wireless interface. In order for AMT to be available via the wireless interface, you need to configure it with the wireless profile(s).

When dealing with large number of systems, adding the wireless profiles in a programmatic way is recommended. The needed API's are listed in the Network Interface Guide in SDK. For a small collection of systems, easiest way to add the wireless profiles is through the web UI supported by Intel AMT. One thing to note here is that addition of the wireless profile can only be done over the wired interface.

Things you need to collect for the wireless profile:

• SSID
• Name for the profile
• Network Authentication (Intel AMT would require either WPA-PSK or RSN-PSK)
• Encryption (TKIP with WPA-PSK or CCMP with RSN-PSK)
• Pass Phrase or Security Key or xProfile

Connect to the webUI on wired interface http://Intel-AMT-IP-Address:16992. After logging in with the credentials, click on wireless settings. Click on New under profiles, and enter the wireless profile parameters.  It is always a good idea to disable the radio, add the profile and enable the radio.

After the addition of the profile and enabling the radio, you can verify the IP address for the wireless interface on the System Status page in webUI. It will take couple of minutes for the wireless IP address to show up. Rebooting the system can expedite the wireless association.

Has this been helpful to you? Do you need to know any more information? Need help with your programmatic solutions? For answers to all your questions related to manageability applications development, visit the forums section and submit your questions.

Recently I was dealing with a forum question and had interesting conversations with the the developer. I made a comment about coding habits when dealing with Intel AMT. With this blog, I am trying to reach out to other developers. I want to hear some of your experiences, what are the tricks you did to get around the problems and so on.

Some of the the things I have observed on the manageability forum are listed below:

• Before issuing a remote control power state command, make sure to check the current power state
• If your SOAP request is not accepted by AMT, try it couple times before giving up. This will probably work provided your SOAP request is well formed and all the authentication requirements are satisfied and the infrastructure configured properly.

So take this opportunity to discuss your experiences with Intel AMT and what you had to do in your software application to encompass those issues. As you know, all of your experiences can guide the new developer and make their life easier. :-)

Ok, now after downloading the WinRM, what do I do? Like any other tool, you have to first configure it :-). The samples provided in AMT SDK only work with digest authentication and un-encrypted channel. So to run the samples in SDK, we need to configure WinRM. Here is how its done:

From a command prompt you can display the current WinRM client

C:\ >winrm get winrm/config/client

Client

    NetworkDelayms = 5000

    URLPrefix = wsman

    AllowUnencrypted = false

    Auth

        Basic = false

        Digest = false

        Kerberos = true

        Negotiate = true

        Certificate = true

    DefaultPorts

        HTTP = 80

        HTTPS = 443

    TrustedHosts = localhost,console,192.168.0.101

Set the AllowUnencypted property to “true”

C:\>winrm set winrm/config/client @{AllowUnencrypted="true"}

Client

    NetworkDelayms = 5000

    URLPrefix = wsman

    AllowUnencrypted = true

    Auth

        Basic = false

        Digest = false

        Kerberos = true

        Negotiate = true

        Certificate = true

    DefaultPorts

        HTTP = 80

        HTTPS = 443

    TrustedHosts = localhost,console,192.168.0.101

Add the host names or IP addresses of the AMT devices you plan on using to the to the TrustedHosts list. This is a comma separated list that supports wild cards.

C:\>winrm set winrm/config/client @{TrustedHosts="*.mydomain.com,myAmt1,192.168.0.101,localhost"}

Client

    NetworkDelayms = 5000

    URLPrefix = wsman

    AllowUnencrypted = true

    Auth

        Basic = false

        Digest = false

        Kerberos = true

        Negotiate = true

        Certificate = true

    DefaultPorts

        HTTP = 80

        HTTPS = 443

    TrustedHosts = *.mydomain.com,myAmt1,192.168.0.101,localhost

Ensure the Digest Auth flag is set to true as follows:

C:\>winrm set winrm/config/client/Auth @{Digest="true"}

Auth

    Basic = false

    Digest = true

    Kerberos = true

    Negotiate = true

    Certificate = true

Phew, that was some configuration. Ok now we are all set and ready to use the samples.

Late July 2007, we have released SCS 3.1 in support for features in AMT 2.5, 2.6, and 3.0. All of the features are not covered by that time and now we have a newer and better version of SCS with more features support. This version of SCS will be posted on our Manageability Developer's Community website.

So what is new in this release? Check out the new features that are supported in this release:

• Support for Intel AMT Release 2.6
• Complete support for environment detection and Host VPN routing
• Support for wireless connections using the host wireless profiles without providing wireless profiles to Intel AMT devices
• Support for Microsoft* IAS RADIUS server using EAP-MSCHAPv2
• Support for Cisco ACS EAP-FAST/TLS
• Support for PXE boot with 802.1x authentication
• Support for Intel AMT authentication to 802.1x if the Host fails to authenticate
• The application now checks the expiration date of the remote configuration client certificate.
• A number of open issues have been resolved (see the Release Notes) and Documentation Updates

You can download the latest version of SCS 3.2 here.

My name is Ajith Illendula and this is my first blog post. I am one of the manageability engineer working for Intel. My role is to support the developer community writing the manageability applications for Intel AMT systems.

If you are currently using Intel AMT SDK 3.0 to develop applications for Intel CentrinoPro Processor Technology or Intel vPro Processor Technology, there is an update available for the SDK which can be downloaded here. You can find more detailed information about the SDK here.

Who needs this update? If you are seeing poor performance during SOL boot, seems like the system is unresponsive during SOL session, then you want this update.

This updated SDK release contains fixes to the following issue:

-Title: Performing SOL boot can seem to hang the Intel® AMT machine
-Symptoms: Performing SOL boot can cause the Intel® AMT machine's boot flow to work so slowly that it might seem that the Intel® AMT machine is not responsive. This behavior does not happen on all Intel® AMT machines, but is BIOS dependant.
-Cause: When opening an SOL session, the Redirection Library does not set all serial control bits needed by some BIOSs.
-Resolution: Use the Redirection Library included in this SDK release instead of previous versions.

All of the documentation errors as indicated by the errata document posted earlier are corrected in this release. For more detailed information about open issues, please refer to the readme file in the SDK distribution.

How do you install this SDK? Simply copy the complete SDK directory structure to a folder of your choice. Alternatively you can chose to copy single components directory. A word of caution for this approach - SDK is designed to be copied as a single unit, many samples rely on common include files and code that is part of the SDK and not replicated in each sample separately.